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Abstract 

Many successful terrorist groups operate across international borders where different 
countries host different stages of terrorist operations. Often the recruits for the group 
come from one country or countries, while the targets of the operations are in an- 
other. Stopping such attacks is difficult because intervention in any region or route 
might merely shift the terrorists elsewhere. Here we propose a model of transnational 
terrorism based on the theory of activity networks. The model represents attacks on 
different countries as paths in a network. The group is assumed to prefer paths of 
lowest cost (or risk) and maximal yield from attacks. The parameters of the model 
are computed for the Islamist-Salafi terrorist movement based on open source data 
and then used for estimation of risks of future attacks. The central finding is that 
the USA has an enduring appeal as a target, due to lack of other nations of matching 
geopolitical weight or openness, ft is also shown that countries in Africa and Asia that 
have been overlooked as terrorist bases may become highly significant threats in the 
future. The model quantifies the dilemmas facing countries in the effort to cut such 
networks, and points to a limitation of deterrence against transnational terrorists. 
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1 Introduction 

Despite vast investments in counter-terrorism, victory in the global war on ter- 
ror remains elusive. In part this is because terrorist groups are highly adaptive 
in their tactics and strategy. When airport scanners were installed to detect 
weapons and explosives, terrorists switched to explosives that cannot be de- 
tected using the scanners and to other modes of attack |2U [S] . When it became 
harder to reach US soil or attack US embassies groups shifted to attacks against 
other countries or less fortified installations [7] [37]. Like international businesses, 
globalized terrorist groups are vast international enterprises that tap into the 
most successful business practices and cost-efficient solutions [2]. If a country 
erects high barriers to entry or develops an effective domestic counter-terrorism 
response then terrorists switch their targeting to a safer and more accessible 
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place. If a country no longer provides a haven for recruitment, training and 
planning of operations, those will shift elsewhere [18 . 

Adaptability makes risk estimation challenging. One possible basis for risk 
assessment is extrapolation of historical data, such as the ITERATE dataset of 
transnational attacks [57]. Fig. [T] shows all ITERATE attacks carried out by 
Islamist groups on OECD countries in which the national origins of the attackers 
and the target country are known. Many of the incidents in the matrix are due 
ethno-nationalist conflicts, such the GIA attacks in France or due to attacks 
by home-grown cells inspired by Salafis. While a substantial fraction of attacks 
were against the US, many attacks also targeted France, the UK and other 
countries. 
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Fig. 1: Terrorist attacks by Islamist groups over 1990-2008. The fraction of all 
transnational plots that originated at country i and targeted country j 
is proportional to the area of a circle at coordinates The source 

countries on the horizontal axis account for > 99% of all attacks against 
OECD countries (vertical). 

In the rest of the paper we will introduce another method for risk assess- 
ment: a quantitative network-based model. The model takes demographic and 
economic information pertaining to violent Islamist-Salafi groups - the most 
probable source of future attacks - and estimates the risk of various transna- 
tional terror plots. The model suggests that the future of transnational terrorism 
may be substantially different from the past: 

1. several regions will become large new sources of transnational terrorism 
(sec.g, 
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2. the US will rise as the terrorists' preferred attack destination (sec. [I}, 

3. successes in stopping foreign-based plots against the US will increase the 



threat to other countries (subsec. 4.1|, and 



4. deterrence will be hard to achieve (subsec. 4.2 1 



The model is based on an activity network for stages of terrorist attacks. The 
network represents decisions required for terrorist operations on the global scale, 
such as which country to attack. No distinction is made between "transnational" 
and "international" terrorism, both referring to terrorist groups that operate 
using foreign bases, support or inspiration. This coarsened scale of analysis 
exposes the strategic picture and can guide counter-terrorism decision making 
at the national and international levels. It also quantifies a kind of unintended 
effect from counter-terrorism measures known as "transboundary externality" 
|301 13"T]: the redirection of terrorists from one country to another, because the 
latter is less protected. 

To the author's knowledge, this is the first model of its kind in the open 
literature. Previous work considered target selection by terrorists but where 
targets are implicitly within a single country so the costs of bringing the attack- 
ers and their weapons to their target are negligible (see e.g. In contrast, 
for transnational terrorism security measures and international logistics play a 
central role in attack planning [161 Ch.3]. Other work considered the structure 
of the terrorist networks at the level of individual operatives or functions, rather 
than as a global network (cf. |10l|23l|5l|13l|38].) 

It is sometimes argued that such economic models of terrorism are unreliable 
because terrorism is an irrational behavior by fanatics. However, the prepon- 
derance of evidence supports the alternative view - the rational choice theory 
(RCT) |34) . RCT claims that terrorist groups and leaders are rational agents 
capable of strategic decision-making. Their decisions are expressions of "instru- 
mental rationality", that is, consistent with their values and objectives [5U]. The 
sophistication and technological adaptability of terrorists, such as in developing 
triggers for explosives, is strong evidence for their intelligence |18l 1X5] . More 
evidence for RCT comes from studies of target selection [3T]. Those consistently 
find evidence for a substitution effect - as governments improve protection to 
certain targets, terrorists substitute them with less protected targets [H l6l 115]. 
Indeed, the defining feature of terrorism - the use of violence against civilians 
rather than against military targets - is a strategic substitution effect because 
the latter are harder targets. Another line of evidence for rationality comes from 
analyzing the internal dynamics of terrorist groups. Rather like non- violent or- 
ganizations, they perform cost-benefit analyses, employ financial controls and 
run financial audits |331 132| . 

2 A Model of Transnational Terrorism 



We now describe a model of a transnational terrorist groups. Such groups are 
characterized by their global aims, as opposed to regional conflicts; they recruit 
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and attack throughout the world. Islamic fundamentalist groups will serve as 
the central application of this model. These include al-Qaida, Hezbollah but 
also possibly extremist groups not currently thought to be violent, such as Hizb- 
ut-Tahrir. Rather than considering specific groups and limiting to their current 
bases of operation, this study will consider every region of the world that cur- 
rently or may in the future host violent Islamic groups. We focus on those groups 
because they are probably the most potent present-day transnational terrorist 
threat. The model could also evaluate other violent transnational ideologies if 
we re-estimate its parameters. 

2.1 Operations Submodel 

Suppose a transnational group controls a cell in a country, and must decide 
where to dispatch this cell (the cell might also be self-mobilizing, in which 
case it must solve its own targeting problem.) The three options are (1) do a 
domestic attack, (2) send the cell to attack another country, and (3) do nothing. 
Option (1) entails certain risks and costs for collecting intelligence and preparing 
weapons. Dispatching the cell into another country, (2), incurs the additional 
cost and risk of interception due to security barriers, such a visas, intelligence 
collection in a foreign environment, and cultural difficulties. However, the other 
country might have more favorable security environment or offer better targets - 
more significant or less protected. Option (3) - abandon the attack and hide - has 
little or no risk or accounting cost and preserves the cell for future operations. 

Any rational decision maker must weight the costs and benefits and take 
the action offering the greatest net benefit. Surely then terrorists would also 
do such analysis, weighing at least the most obvious target choices and travel 
routes. A simple way of representing this is with an activity network, where 
nodes represent different stages of terrorist operations at different countries, 
and edges show the cost and risk involved in each stage (Fig. |2|. In Fig. [2] the 
columns correspond to the countries, including the country of origin, while the 
rows correspond to the postures of the cells: the stages of the plots. 

The network represents the options of the rational decision maker as directed 
paths - chains of nodes and directed edges that start in the source country node 
and lead to either the "attack" node or the "abandon/hide" node. If complete 
information is available about the costs and benefits of each option, then the 
rational decision is to select the path with the highest utility, that is the path 
with highest net benefit (benefit minus cost.) For any path p, the cost c(p) is 
found by adding the weights on the edges (tasks) constituting the path. 

The edge weights of this network could represent resources like money or 
materiel that are consumed and produced by terrorist operations. The network 
could also be used to perform a probabilistic risk assessment (PRA) : to evaluate 
the gains from possible operations and the probabilities of successfully complet- 
ing intermediate stages in the operations. Such a PRA is what we will do. In 
other words we will take the perspective of the terrorists: determine what they 
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Illustration of the model for 5 countries. The vertical direction represents 
countries while the horizontal represents different stages in execution 
of plots. Domestic attack plans correspond to motion upwards, while 
transnational attacks also make a diagonal transition. The full model 
includes many more countries. 
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want and what they fear in order to anticipate how they will actQ 

It is an open question whether terrorist groups can or will use such an alge- 
braic method to analyze their operations. However, given their sophistication 
they may well come to the same decisions using other means or through op- 
erational experience. Of course they might also intentionally avoid the most 
probable attacks to achieve surprise, but only at a cost (and models could also 
be constructed to anticipate that too.) 

Consider now the following specific model for transnational terrorist attacks, 
Fig. [2] A cell that was mobilized at country i experiences (1) the translocation 
cost/risk, Ty, representing the barriers for moving from country i to country j; 
(2) the risk of interception at country j, If, and (3) the yield Yj from attacks 
at country j. Yield reflects the gain to the terrorists from a successful attack, 
and so has the opposite sign from cost. A domestic attack at country i has cost 
c(p) = Tu + Ii + Yi while a transnational attack has cost c(p) = Tjj + Ij + Yj 
(i 7^ j). Because negative edge weights are costs in the sum that represent risks, 
the words "cost" and "risk" will be used interchangeably. Sometimes attackers 
reach country j through one or several intermediate countries (exploiting e.g. 
the Schengen treaty), a possibility we ignore for simplicity. From the counter- 
terrorism point of view, the likelihood of a particular plot depends also on 
the supply of plots originating at each country. Therefore, we will estimate 
for each country i the number of cells that originate there, Si. If the group 
decides to abandon, its path has cost c(p) = A. The value of A may be a 
negative, representing the preservation of the cell, or positive, if the cell cannot 
be reactivated. 

It is possible to include additional costs like cost of recruitment or training 
in the model but this will be left for future studies because the data is hard to 
estimate. Here it was assumed that the costs are negligible and indeed many 
cells involved in recent attacks recruited themselves and trained with informa- 
tion obtained from websites. Another possible extension is attacking country j 
through its foreign representatives: embassies, officials and even tourists. Such 
attacks represent a different type of attack path and could be easily added, al- 
beit by adding more hard-to-estimate parameters to the model. Similarly, one 
may consider attack on modes of international transit such as airplanes and 
ships. 

The model's parameters can be estimated from open source information with 
a modest degree of confidence (see section [3]) . Briefly, transit costs were esti- 
mated from data on global migration, the risk of interception from national 

1 Here is how PRA is represented by networks. Suppose in a multi-stage terrorist operation 
r B is the probability of success at stage s (out of k stages in total) conditional on success 
at every previous stage. Suppose the gain from a successful operation is G (> 1). Then 
the expected gain from the operation is E = r\T2 ■ ■ • ffcG. Let us now relate r s values to 
costs (c s > 0) using exponentiation: r s = e~ Cs , and let the gain be a function of yield Y: 
G = e~ Y . Thus, an attack has expected gain E = exp [— (ci + C2 + . . . + + V)]. In the 
network representation of terrorist operations, we can compute the sums in the exponent by 
adding edge weights along network paths that trace through all the stages. Paths of lower 
weights translate to attacks of greater expected gain. By comparing such paths we could 
anticipate which attacks would have the highest expected gain. 
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expenditure on internal security and attack yields based on the political power 
of the targeted country, represented by its GDP. The supply of plots is esti- 
mated from public opinion surveys measuring support for terrorist attacks and 
demographic data. 



2.2 Stochastic Decisions Submodel 

If transnational terrorist groups could determine the values of the parameters 
precisely (the next section discusses this problem), then they should be able to 
plot the optimal attack from each country i by considering all possible options 
and finding the path that minimizes cost: 



mm 
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However, one of the general difficulties in decision making is uncertainties 
about costs and risks. Terrorists, like other decision makers should therefore 
occasionally identify the optimal attack incorrectly. Reliable risk assessment 
must therefore take into account the possibility that adversaries make mistakes 
(as well as use unpredictability to achieve surprise - but that is even harder 
to assess.) Fortunately, suitable stochastic prediction methods have already 
been developed for activity network models like in Fig. [2j With those methods 
probabilities can be assigned to different terrorist plans based on the costs of 
the corresponding paths on the network. We use the model in |14[ Ch.3] based 
on Markov chains. In it the path of least cost is typically assigned the highest 
probability but other paths have non-zero probabilities, and these probabilities 
can be quite high (for details see Appendix, sec. |B])p| 

From this Markov chain model it is possible to compute the number of times 
any particular country (represented by its attack node) would be targeted as well 
as to compute the changes in targeting due to various defensive actions, which 
are represented as increases in edge weights. It is also possible to determine 
whether defensive actions would materially increase the costs for the adversaries 
or merely lead them to change targets. 



2 One of the advantages of the stochastic model is that it can interpolate between the two 
extremes of complete ignorance and perfect information using a single parameter A (> 0) 
that describes the amount of information available to the adversaries. For a given level of 
information, the probability that a path p would be selected is proportional to exp(— Ac(p)). 
When A is very large the path of least cost has a much higher probability than any of the 
alternatives, while A close to assigns all paths approximately the same probability. We set 
A = 0.1 in the following but its value has a smooth effect on the predicted plots (i.e. the 
sensitivity is low). A value of 0.1 means that if the terrorist group learns of a increase in path 
cost by 10 units, its probability of taking the path will decrease by a multiplicative factor of 

2.72. The effect depends on the original path probability: it is not as great a decrease when 
the original probability is high. 
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3 Estimation of Parameters 

The model contains several sets of inputs: (1) the supply of plots at country i, Sf, 
(2) barriers for moving from country i to country j T,^-; (3) risk of interception 
at country j, Ij\ and (4) the yield from attacks at country j, Yj. The yield 
of abandoning, A will be set to oo (no abandoned plots) and its effect will 
be analyzed separately. Because (l)-(4) contain security-related information 
that is also difficult to measure, the information is not published. Luckily, one 
can derive estimates from publicly-available demographic and economic data. 
Readers wishing to see the final results of estimates should skip to tables [l] [3] 
and [2] of the Appendix and ignore the rest of this section. 

In building the estimates, it will be assumed for simplicity that each stage 
of terrorist operations carries about the same amount of risk. Namely, that the 
medians of T^- (i ^ j) and of Ij both equall. Of course, some plots will be much 
less risky than others because both Tij and Ij have considerable variability. The 
yield from attacks is also normalized relative to the median. Transformations 
of this kind on costs and yields are unavoidable if we wish to remove the effect 
of units, but they do reduce the reliability of the model. However, the core 
findings of the model regarding certain countries agree well with intuition, as 
will be seen. 

3.1 Estimating the Supply of Plots, Si 

To assess the threat from the greater violent Islamic movement it is not suf- 
ficient to consider the support for a particular group like al-Qaida. Even if 
we assumed that al-Qaida has no support in certain countries, other groups 
might mobilize supporters there. Another concern is self- mobilization: modern 
terrorist groups sometimes avoid active recruitment and instead provide inspi- 
ration and guidance while relying on self-radicalization to provide them with 
foot soldiers [25] . 

A comprehensive picture on possible plots can be obtained from surveys. 
Over the last decade most recently in 2009 the Pew charitable trusts run several 
global attitude surveys which among others, asked Muslims about their support 
for suicide bombings [36] . In each of the surveyed countries respondents were 
asked to state whether suicide bombings is "never justified" (er™), "rarely justi- 
fied" (cr r ), "sometimes justified" (a s ), and "often justified" (a°). These are given 
as fractions of the respondents. For some countries no data was available, so the 
quantities were extrapolated from countries in the same geographic region (e.g. 
Middle East, Americas etc.) Pew also collected data on the Muslim population 
in 235 different countries and territories (Jj) [24] (of course the overwhelming 
majority of Muslim everywhere are opposed to terrorism in the name of their 
religion) . The supply of violent plots can be estimated by taking the population 
and multiplying by the weighted fraction of respondents professing support for 
violence (the weights are s r , s s , s ). One must also take into account that only a 
small fraction of those who profess radical ideology would actually be involved 
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in a plot and that several people are involved in each plot (a factor Q): 
Si :— Q ■ Ji ■ (s r a r + s s a s + s a°) . 

The support weights were set by default based on the assumption that every 
increase in professed support leads to an increase by a factor of 2 in the re- 
sources available to terrorist groups: (s r , s s , s o )=(0.25, 0.50, 1.00). Appendix [A] 
explores the sensitivity of supply Si to this assumption through two alternatives: 
most of the tangible support come from the narrow but committed minority, 
(s r , s s , s o )—(0.1, 0.2, 1.0), and a situation where even the least-committed sup- 
porters materially boost the terrorists, (s r , s s , s o )=(0.33, 0.66, 1.00). Notes that 
the weights effect only the relative importance of regions as sources of terrorism, 
not the targets of plots originating in a given region. 

The factor Q is dependent on social and tactical issues, and hence should 
not vary much across countries. Because Q enters as a multiplicative term 
at all source countries, its value has no bearing on the relative risk estimates. 
Nevertheless, it could be crudely estimated as follows. In 2006 the head of the 
British Security Service (MI5) reported that: "... my officers and the police 
are working to contend with some 200 groupings or networks, totaling over 
1600 identified individuals (and there will be many we don't know) who are 
actively engaged in plotting, or facilitating, terrorist acts here and overseas" 
|25| . Furthermore "over 100,000 of our citizens consider that the July 2005 
attacks in London were justified." This implies active participation at a rate of 
at least 1.6% and 8 people per plot (Q = 0.002). 

3.2 Estimating the Barriers for Moving from Country i to 
Country j, Ty 

Barriers to transnational attacks include both deliberate barriers such as screen- 
ing and intelligence, and unofficial barriers such as differences in language and 
culture. Official barriers depend on factors such as the intelligence available on 
targets in the destination country, the cooperation the targeted country received 
from both the country of departure and the transport agent (e.g. airline). None 
of those figures are publicly available but a proxy measure can be found, as 
follows. Transnational terrorists often use tourism, education or immigration as 
cover to obtain travel documents and permits. Indeed, travel in all of those cate- 
gories became more difficult across the developed world as a result of the security 
measures introduced after the 9/11 attacks. Migration patterns thus provide an 
estimate of official barriers. Unofficial barriers to migration are likewise similar 
to the unofficial barriers to terrorism, including differences in language, culture, 
ethnicity and others. Therefore, the foreign-born migrant population, suitably 
normalized, could be used as a proxy of transnational freedom of travel. Migra- 
tion into most OECD countries is documented by the OECD [28J. 
It is to be expected that the number of migrants would be positively correlated 
with the population of the countries and negatively correlated with distance. 
This is known as a "gravity law" model. Many national and international re- 
lationships such as trade flows are well-approximated by gravity laws [9j [19], 



3 Estimation of Parameters 



10 



named for their similarity to Newton's law for the force of gravity. Therefore 
an estimate for the number of migrants between country i and country j is 
the product of their populations (data: UN) divided by their distance squared 
(data: CEPII [M|): ^f 2- - When the actual number of migrants, m.y, falls below 

ij 

this estimate, that may indicate heightened official or unofficial barriers. Thus 
we define the raw transnational terrorism barrier between countries i and j as: 

T ■ '''''' m 

The data must now be standardized, for several reasons: (1) the barrier data 
should be comparable with other costs considered by the terrorists (and in the 
model) by removing the effects of units for population and distance; and (2) 
since the barrier is a cost and risk, it must be represented by positive number 
in the activity network. Therefore, the quantity Tu was computed from by 
determining the minimum {MinT) and median (MedT). Because of (2) MinT 
is subtracted from Ty, and for (1) the quantity is divided by the median of the 
shifted values: 

Tij = - MinT) j (MedT - Minfj . 

The resulting values have a median of 1.0. The more standard procedure of first 
removing the average and dividing by the standard deviation was rejected be- 
cause the distribution is visibly non-Gaussian with large positive outliers (hence 
a skewed mean and large variance) . Domestic operations will be assumed to have 
negligible barriers (Ta = for all countries i). The OECD data lacks informa- 
tion about migration to non-OECD countries. Therefore set Tj = oo in all such 
cases (effectively blocking such paths). 

While the OECD includes some of the most geopolitically-important nations 
of the planet, obtaining data on translocation costs to non-OECD countries 
would be valuable for two reasons. First, only with such data can we estimate 
the risk of terrorism to those nations (such as the July 11 bombings in Kampala), 
and second to estimate the effect of counter-terrorism policies in the OECD on 
terrorism in other countries. Indeed, in the ITERATE database of terrorist 
incidents [57J , attacks on OECD countries that can be traced to Islamist groups 
account for only 22% of all Islamist attacks. 

3.3 Estimating the Risk of Interception at Country j, Ij 

The risk of interception can be estimated from OECD data on expenditure on 
public order and safety as percentage of GDP. The relevant figure is the fraction 
of GDP rather than the raw figure because the number of valuable targets is 
related to the size of the economy, so the fractional figure indicates the 

level of security vulnerable sites can receive. The GDP also correlates with 
the population size (in rich countries) and thus to the amount of police resources 
available per person. The extreme case of totalitarian police states is suggestive: 
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in such countries internal security expenditures are disproportionately large rel- 
ative to the GDP, and indeed terrorists have a lot of difficulties operating there 
fT"7] . This estimate of course neglects the efficiency of internal security force - a 
factor that is hard to estimate. 

The internal security data is transformed almost exactly like the barrier data 
and for the same reasons: start with figures for internal security expenditure as a 
fraction of GDP for country j, SECj then compute the minimum (MinSEC = 
minj SECj) and median (MedSEC), and then normalize: 

Ij = (SEQ - MinSEC) / (MedSEC - MinSEC) . 

Generally speaking, we find that there is not much variation in the risk of 
interception in different countries (raw data is in the Appendix, sec. |Aj ), as 
compared to variation in factors such as yield, discussed next. This suggests 
that interception risk plays a minor role in target choice. 

3.4 Estimating the Yield from Attacks at Country j, Yj 

Transnational terrorist attacks attempt to influence policies. For example, one 
of al-Qaida's original objectives was to compel the withdrawal of US forces from 
Arabia, while Hezbollah forced France and the US to withdraw their peacekeep- 
ers from Lebanon in the 1980s. The precise value of targets shifts with time 
and the political situation, but typically larger richer countries make for more 
powerful players in the international arena, and hence more important targets. 
Moreover, their homelands carry more targets of symbolic, political and eco- 
nomic significance. The economic damage from the loss of life and physical 
assets is also higher in richer countries because they tend to have higher pro- 
ductivity for labor and capital. Thus, it is expected that transnational terrorists 
would seek to attack larger richer countries. The weight of a country can be 
estimated from its dollar GDP figures at current exchange rates (source: UN 
data). 

Timing or political dynamics does play a role in transnational terrorism but 
its importance might be overestimated. For example, the Madrid 2004/03/11 
train bombings are often viewed as intending to pressure the Spanish government 
to withdraw its forces from Iraq, and they were timed with the Spanish elections. 
But surely an important factor was Spain's geopolitical weight (GDP is ranked 
12th in the world) and its large contribution to the 2003 invasion. Otherwise 
al-Qaida could have just as well pressured smaller countries such as El Salvador 
and Mongolia to withdraw their contributions to the invasion. 

Here is how the yield Yj was computed from the GDP figures. Recall that 
costs (barriers, internal security) are all positive, so yields must be negative. Let 
the minimum GDP be MinGDP, and the median MedGDP. The following 
formula produces negative values with a standardized median: 

Yj = (MinGDP - GDPj) / (MedGDP - MinGDP) . 

The resulting values have a median of —1.0. 
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4 Predictions 

One way of representing the solution of the model is through an attack matrix, 
the counterpart of the historical data matrix in Fig. [I]) The model predicts 
(Fig. [3]) that the United States would attract the bulk of transnational terrorism 
- all other countries are almost free of terrorism (white squares). The reason 
the United States is such a magnet is because of its vast geopolitical weight and 
relatively open borders. 



Australia - 
Austria - 
Belgium - 
Canada - 
Czech Rep. - 
Denmark - 
Finland - 
France - 
Germany - 
Greece - 
Hungary - 
Ireland - 
Italy - 
Japan - 
Luxembourg - 
Netherlands - 
New Zealand - 
Norway - 
Poland - 
Portugal - 
Slovakia - 
South Korea - 
Spain - 
Sweden - 
UK - 
US < 
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Fig. 3: Predicted attack risk matrix. The area of a circle at coordinates 

is proportional to the number of plots from i to j. The bottom row 
indicates that the vast majority of plots target the US. 

Examination of the sources for attacks exposes a number of risks. There is 
a considerable terrorist threat from Bangladesh. India, Indonesia and Nigeria. 
They combine a large population and relatively high support for terrorism. It is 
notable that the 2009 Christmas bomber was Nigerian - one of the first attacks 
on OECD from that country. 

The high burden of attacks borne by the US is directly related to the rational 
choice model: if there is a big prize to be won by attacking the US, no rational 
terrorist would attack other countries. The reasons why non-US attacks do occur 
(cf. Fig. [TJ include: (1) some terrorist groups such as ethno-nationalist groups 
see as their enemy a particular country and lack a global strategy; (2) global 
Salafi groups have not yet expanded their recruitment channels in countries 
such as Nigeria and Bangladesh, so a large fraction of attacks is still carried 
out by groups with more narrow agendas; and (3) the US has deployed counter- 
terrorism measures commensurate with the threat it faces, making the US too 
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costly to attack. 

One implication of this finding concerns US policy. The matrix justifies 
in principle outlays by the US government towards countering international 
terrorism as a whole, without regard to its target. Investments in international 
counter-terrorism measures, such as policing, if effective in reducing the number 
of plots, are also efficient from the US perspective because the US, being the 
target of choice, will retain most of the benefits from reducing the terror threat 
[22_. Unfortunately, many policies previously adopted were ineffective or had 
perverse effects on international terrorism (the so-called "blowback") (see e.g. 

4.1 National Fortresses 

Consider now several alternative scenarios for the future, motivated by strength- 
ening of counter-terrorism defenses, which may make transnational attacks less 
feasible. Suppose the US was successful in deterring attacks against itself by 
greatly increasing the barriers to entering US soil. If so, Fig. [2] shows the likely 
effect . 

The protection of US frontiers will significantly increase the attack risk to 
most other OECD nations because transnational groups should then switch to 
more accessible targets. Perhaps surprisingly, Japan, now rarely mentioned as a 
target will see the largest absolute increase in terrorism. This prediction is due 
to its international profile, Japan being the second largest country in the OECD 
on several measures. Japan's woes will be shared to some extent by most other 
major OECD countries, who will also see an increase in attacks. 

Another possible scenario is where the security forces in each country are 
able to intercept the majority of external plots against their homelands. In 
other words, the translocation cost becomes very large (T^- = oo for i ^ j). In 
this world, the dominant form of terrorism is home-grown. As Fig. [5] shows, 
this materially changes the risk matrix. Countries such as the France, with 
relatively large and relatively radicalized Muslim communities will see much 
more terrorism. 
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Fig. 4: Attack risk matrix in scenario where US becomes inaccessible to foreign 
plots. Terrorist plots increase in all other OECD countries. 
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Fig. 5: Attack matrix in a scenario where OECD countries cannot be accessed by 
foreigners (both inside and outside the OECD). Countries with relatively 
large radicalized Muslim populations (e.g. France) rise in rank relative 
to their OECD peers. The total number of attacks on OECD countries 
must decrease significantly because foreign plots are blocked. 

The two scenarios point to large conflicts of interest between OECD countries 
in tackling transnational terrorism. Helping the US intercept plots through 
advance warning will increase terrorism everywhere else. More broadly, country 
A will not always benefit from helping country B. Doing so might sometimes 
increase the chances that A's enemies, some of which even based in B, will 
shift to B. This factor may explain part of the difficulty achieving intelligence 
sharing and international police cooperation. Indeed B could even come to 
an understanding with its home-grown terrorists in which they abstain from 
domestic attacks in return for non-intervention in their activities. 

4.2 Deterrence 

A number of defensive strategies are founded on deterrence. In terrorism, deter- 
rence may involve convincing would-be groups or cells that operations are too 
risky or that the entire struggle they wage is hopeless. The model can express 
such conditions on a global level by varying the parameter A, the perceived 
yield from abandoning. Raising this yield is equivalent to raising risks through- 
out the network. The effect of A is non-linear, showing a threshold at around 
A = — 35 beyond which attacks decline (Fig. [6j) Unfortunately, the threshold 
lies quite high, indeed nearer to the yield from attacking the US (—54) than 
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countries such as France (—6.8), implying that it would be necessary to create 
a very large deterrence effect to reduce the number of plots. 

If this level of deterrence is somehow achieved, the reduction in attacks will 
not occur at once in all countries because cells in some countries have lower 
translocation costs than cells in other countries. As a result, their perceived 
net benefit and probability of success arc higher. Thus plots originating within 
the developed countries such as the G7 and especially home-grown plots will be 
the last to experience deterrence because they originate so close to high-value 
targets. 



500000 
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♦ ♦ ♦ ♦ ♦ . 








• — • attacks 








abandoned 








* * plots 
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Yield of abandonment (A) 

Fig. 6: The number of attacks as a function of the yield from abandoning. Neg- 
ative values make abandoning more competitive and decrease attacks 
(left side) while positive values indicate that abandoning is costly and 
encourage attacks (right side) . The vertical black line indicates the yield 
from attacking the US - the most valuable target. The sigmoid shapes 
suggest that the effect of deterrence is low until a threshold is reached, 
but the threshold must be close to the perceived value of attacking the 
US. 
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5 Discussion 

The network model draws attention to differences between our past experi- 
ence with terrorism and its possible future. Populous regions like Nigeria and 
Bangladesh are predicted to produce many plots although they have not par- 
ticipated significantly in transnational terrorism yet. If those regions start pro- 
ducing terrorists at a level commensurate with their size and radicalization, 
the world will see many more attacks. Alternatively, it is possible that those 
regions have characteristics that hold back violent extremism. If so, future re- 
search should identify those characteristics and suggest policies that maintain 
and encourage them. 

The model confirms the significant danger from substitution effects. Per- 
ceived successes in reducing the number of attacks against it may be due to a 
strategic redirection by terrorist groups that increases the risk to other coun- 
tries. In the scenario where the US deters all attacks by foreign terrorists, many 
other countries would experience a large increase in threats. To an extent this 
has already been seen in Europe. 

The model introduced above has limitations, some introduced for simplicity, 
some that are inherent from its foundation as a network model. Perhaps the 
most significant shortcoming is the assumption that a terrorist group's main 
resource are its human resources. In practice, attacks also require intelligence 
gathering, training and materials. Those resources need to be brought together 
while maintaining motivation and secrecy. Nevertheless, the model captures 
some of the probabilistic analysis used by transnational groups within the well- 
developed framework of network theory. 

6 Conclusions 

The paper introduces a model of transnational terrorist groups that represents 
operations as a global activity network. It is possible to estimate the parameters 
of the model, and then predict the number of plots directed at OECD target 
countries from countries throughout the world. The model highlights the excep- 
tionally high risk of attacks against the US. If the US is successful in deterring 
attacks against itself without reducing the overall supply of terror then most 
OECD countries would see sharp increases in attacks because of a substitution 
effect . 

The scale of the substitution effect calls for studies into counter-terrorism 
policies that are designed to anticipate and sterilize it. Fortunately, the problem, 
termed "network interdiction" has already been studied in the context of other 
networks [551 H] . Those mathematical methods can identify where barriers can 
be erected in the transnational terrorist network to produce an increase in the 
costs to the terrorists in such a way that they cannot avoid it by shifting their 
plots to other countries. Therefore it should be possible to develop efficient and 
game-theoretically robust multi-national defense strategies. 
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A Parameter Estimates 



Tab. 1: Information about countries: the interception cost (left) and the yields 
from attacks (right). The interception cost (Ij) is not known for all 
OECD states. For this reason, only the countries where it was available 
(the left table) were considered as possible targets. 



Country 


Intercept. Cost Ij 


New Zealand 


2.3 


United Kingdom 


2.1 


Czech Republic 


1.6 


Hungary 


1.6 


United States 


1.5 


Slovakia 


1.5 


Estonia 


1.5 


Portugal 


1.4 


Italy 


1.3 


Spain 


1.3 


Poland 


1.2 


Netherlands 


1.2 


Israel 


1.1 


Belgium 


1.1 


Slovenia 


1.0 


Germany 


1.0 


Canada 


0.9 


Austria 


0.9 


Iceland 


0.8 


Ireland 


0.8 


Japan 


0.8 


Sweden 


0.7 


Finland 


0.6 


France 


0.6 


South Korea 


0.6 


Greece 


0.5 


Denmark 


0.3 


Luxembourg 


0.2 


Norway 


0.2 


Australia 


0.0 



Country 


Yield Yj 


United States 


-54.0 


Japan 


-24.1 


Germany 


-9.5 


United Kingdom 


-7.8 


France 


-6.8 


Italy 


-5.3 


Canada 


-3.8 


Spain 


-3.2 


South Korea 


-3.1 


Australia 


-2.2 


Netherlands 


-1.8 


Sweden 


-1.2 


Belgium 


-1.1 


Austria 


-0.9 


Poland 


-0.9 


Norway 


-0.8 


Denmark 


-0.7 


Greece 


-0.6 


Finland 


-0.6 


Ireland 


-0.5 


Portugal 


-0.4 


Czech Republic 


-0.2 


New Zealand 


-0.2 


Hungary 


-0.2 


Slovakia 


-0.0 


Luxembourg 


-0.0 
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Tab. 2: Translocation costs (country i to country j) for select country pairs. 
Rows are countries of departure, columns are the destinations. Notice 
that Japan has relatively large barriers, as estimated by its abnormally 
low population of immigrants. 
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Tab. 3: The supply of plots for the default weight and change under two al- 
ternative weightings (high commitment and low commitment.) Certain 
countries are unusually dependent on the level of support the most rad- 
ical segment provides, while others see relatively broad support for vio- 
lence. Only the 30 largest sources are shown. For some countries in a 
particular region the sensitivity is identical because direct survey data 
was not always available. In those countries the radicalization values 
(a r , <j s , a°) were imputed from regional estimates. 



Country 


Supply Si 


High commitment 


Low commitment 


Indonesia 


52745.4 


-46.2% 


24.6% 


Nigeria 


52687.8 


-33.3% 


17.8% 


India 


49624.7 


-43.1% 


23.0% 


Bangladesh 


39960.8 


-33.8% 


18.0% 


Iran 


26723.7 


-30.6% 


16.3% 


Egypt 


24731.6 


-41.0% 


21.8% 


Pakistan 


16537.8 


-22.1% 


11.8% 


Algeria 


12387.6 


-30.6% 


16.3% 


Iraq 


11021.7 


-30.6% 


16.3% 


Sudan 


10910.5 


-30.6% 


16.3% 


Afghanistan 


10168.3 


-30.6% 


16.3% 


Saudi Arabia 


9037.1 


-30.6% 


16.3% 


Yemen 


8462.6 


-30.6% 


16.3% 


Ethiopia 


8278.6 


-39.7% 


21.2% 


Mali 


8247.4 


-23.2% 


12.4% 


Uzbekistan 


8161.3 


-43.1% 


23.0% 


Syria 


7315.4 


-30.6% 


16.3% 


Morocco 


6878.5 


-26.5% 


14.1% 


China 


6680.7 


-43.1% 


23.0% 


Niger 


6497.3 


-32.2% 


17.2% 


Malaysia 


6466.6 


-47.7% 


25.4% 


Turkey 


5521.4 


-44.0% 


23.5% 


Russian Federation 


5081.9 


-43.1% 


23.0% 


Palestine 


4632.0 


-21.1% 


11.2% 


Burkina Faso 


4004.9 


-32.2% 


17.2% 


Tunisia 


3700.5 


-30.6% 


16.3% 


Senegal 


3668.5 


-40.3% 


21.5% 


Guinea 


3664.4 


-32.2% 


17.2% 


Cote d'lvoire 


3338.1 


-32.2% 


17.2% 


Somalia 


3258.2 


-30.6% 


16.3% 



In certain countries, such as Malaysia, Indonesia and Turkey support for 
violence is relatively broad. This can be seen from the large decrease in supply 
under the high-commitment scenario, (s r , s s , s o )=(0.1, 0.2, 1.0), compared to 
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the default weights (s r , s s , s o )=(0.25, 0.50, 1.00). In regions such as the 
Palestinian Territories, Pakistan and Morocco the support is more dependent 
on the radical minority, as seen from the relatively small increase under the 
scenario (s r , s s , s o )=(0. 33, 0.66, 1.00). Overall, the 10 largest sources of plots 
are not more sensitive to those parameters than other sources. 

B Computation of Probabilities 

In the framework of the theory of complex networks, attack plots could be 
represented as the motion of an adversary through a weighted network (the plot 
itself is the adversary we wish to stop.) The adversary aims to find an attack 
path or to hide, whichever plan has the lowest cost. To map such a decision to 
the framework of activity networks, connect the "attack" and "abandon" nodes in 
Fig. [2]to a node termed "end" with edges of cost 0. Thus, an attack on a country 
j corresponds to an adversary that starts at country i and goes through country 
j and then to the node "attack" and finally to "end". The decision to abandon 
corresponds to an adversary that starts at country i then goes to "abandon" and 
then to "end". The expected number of attacks on a particular target t can be 
computed by combining information about path costs with information about 
the supply of plots from a particular country Si and the yield of abandonment 
A. Namely, it is the number of trips from all sources that arrive to the "attack" 
node from target country t. 

The least-cost path corresponds to the optimal choice by the terrorists, but 
they can make mistakes. An attack plan under uncertainty could be described as 
a Markov chain [14, Ch. 3]. The chain has initial distribution proportional to Si, 
and a transition probability matrix M describing the likelihood of taking a par- 
ticular edge on the network. The "end" node is the absorbing state of the chain. 
The M matrix can be computed using the least-cost guided evader model de- 
scribed in [141 Ch. 3]. Briefly, for each edge (u,v) of the network, the transition 
probability through it is given by the formula M uv cx exp(— A (c(p uv ) — c(p u *)), 
where c(p usr ) is the cost of the least-cost path from node u to the end node, and 
c(p uv ) is the cost of the path through edge (u,v): p uv = (u,v) Up v *. Thus, the 
model generalizes the least-cost path modefj The parameter A was set to 0.1, 
in the reported data, but its value has a smooth effect on the predictions of the 
model because of the smoothness of the exponential function. The number of 
plots against a target country t is now found by taking the probability of a trip 
to that target multiplied by the total number of plots (— J2i Si)- 



3 To compute the distances to the "end" node, c(p uv ), we use the Bellman-Ford algorithm 
because edge weights are negative for some edges (e.g. yield from attacks). Ref. 1 141 Ch. 3] 
uses the faster algorithm of Dijkstra because it treats only the case of positive weights. 



